If your app has a file upload button, congratulations — you've built a malware distribution channel.

That's not an exaggeration. Every support ticket attachment, every document upload in your CMS, every CSV import in your analytics tool — they're all vectors. And most SaaS products treat them like trusted input.

The uploads you're not scanning

Think about the file upload flows in your app. Users upload profile pictures, attach files to support tickets, share documents with teammates, import spreadsheets. Most developers validate file type and size, maybe check the extension. That's it.

Here's what they don't check:

Executable payloads disguised as documents. A file named invoice.pdf.exe with a PDF icon. Your extension check passes. Your users get infected.
Macro-laden Office files. A .docx with a VBA macro that downloads a payload when opened. Completely valid file type.
Polyglot files. Files that are simultaneously valid PDFs and valid ZIPs containing executables. Your MIME type check sees a PDF. The OS sees something else.
Obfuscated scripts. PowerShell scripts that download and execute remote payloads. They look like text files.

The common response: “We're a B2B SaaS, our users are trusted.” Sure. Until one of their accounts gets compromised and an attacker uploads malware through your platform to reach every other user who opens that shared file.

Why building it yourself is a trap

“How hard can it be? We'll just run ClamAV.”

It starts simple. Install an antivirus engine. Scan files on upload. Ship it.

Then reality sets in:

Virus definitions need daily updates. An antivirus engine is only as good as its last update. You need a pipeline to pull fresh signatures, rebuild or reload, and deploy — every day. Miss a day and you're blind to new threats.
One engine isn't enough. No single engine catches everything. The industry standard is multi-engine scanning. That means running multiple tools, merging results, and deciding on a combined verdict. Each engine has different installation requirements, licensing, and update cycles.
Scanning is CPU-intensive. A single file scan can take seconds and consume significant memory. Run that on your app server and watch your API latency spike during upload bursts. You need dedicated infrastructure.
File handling is a security surface. You're downloading untrusted files to disk, executing scanning tools against them, and parsing the output. One vulnerability in your scanning pipeline and the malware is running on your infrastructure instead of being detected.
False positives need handling. Users will upload legitimate files that get flagged. You need a review workflow, a way to whitelist, and clear communication about why their upload was rejected.

What started as “just run ClamAV” is now a security infrastructure project with dedicated servers, update pipelines, monitoring, and on-call. You signed up to build a project management tool, not a malware lab.

The API approach

The alternative is to treat file scanning like you treat email delivery or payment processing: use a dedicated service via an API.

The integration looks like this:

// In your upload handler
const file = req.file;

// 1. Upload to scanning API
const scan = await fetch("https://api.usebouncer.dev/v1/scan", {
  method: "POST",
  headers: { "X-API-Key": process.env.BOUNCER_API_KEY },
  body: formData,
});
const { data } = await scan.json();

// 2. Store the scan_id with the file record
await db.files.update(fileId, { scan_id: data.scan_id });

// 3. Poll or use webhook for result
// Block the file from being shared until verdict is "clean"

Three lines of integration code. No servers to manage. No definition updates. No scanning infrastructure. Your upload handler stays fast because the scan runs asynchronously — you get the scan ID back instantly and check the result later.

What to look for in a scanning API

Not all scanning APIs are equal. Here's what matters:

Multi-engine detection. Signature-based detection catches known malware. Pattern-based detection catches suspicious behaviors and zero-day variants. You want both.
Async-first design. Scanning takes time. The API should return immediately and let you poll for results. If the API blocks until the scan is done, your upload endpoint will timeout on large files.
Simple auth. An API key in a header. Not OAuth, not mutual TLS, not a 47-step onboarding wizard. You want to go from signup to first scan in under 5 minutes.
Transparent pricing. Per-scan pricing with a generous free tier. No “contact sales” for a price. No annual contracts for a feature that should take 10 minutes to integrate.
File privacy. Your users' files should be scanned and deleted. Not stored, not shared, not used for training. Short retention (24 hours or less) with encryption at rest.

When to scan

The most common pattern is scan-on-upload: every file gets scanned before it's made available to other users. But there are other patterns worth considering:

Scan on upload, block until clean. The safest approach. Files are quarantined until the scan completes. Users see a “processing” state. Good for document sharing and collaboration tools.
Scan on upload, allow with warning. Files are immediately available but flagged if threats are found. Good for internal tools where speed matters more than absolute safety.
Scan on download. Scan when a file is requested, not when it's uploaded. Catches threats that weren't in the database at upload time. More expensive (scans on every download) but more thorough.
Periodic re-scan. Re-scan stored files against updated threat databases. Catches files that were clean when uploaded but are now known to be malicious. Good for long-lived file storage.

The cost of not scanning

The math is simple. A file scanning API costs a few cents per scan. A security incident costs:

Engineering time to investigate and remediate
User trust — once lost, very hard to rebuild
Potential legal liability if you're distributing malware to your users
Compliance violations (SOC 2, ISO 27001, HIPAA all have requirements around malware protection)

The median cost of a data breach in 2025 was $4.88 million. The cost of scanning 10,000 files per month is $49.

Start scanning

If your app accepts file uploads, add scanning. It's a few lines of code and it eliminates an entire class of risk.

Get started with Bouncer — 500 free scans per month, no credit card required.